This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new 669b9c359 enh: document cookie options
669b9c359 is described below
commit 669b9c3595281d368cee0d84a71c5a080bc83753
Author: lprimak <[email protected]>
AuthorDate: Thu Apr 30 10:35:21 2026 -0500
enh: document cookie options
---
src/site/content/jakarta-ee.adoc | 5 +++++
src/site/content/spring-boot.adoc | 4 ++--
src/site/content/spring-framework.adoc | 4 ++--
src/site/content/troubleshooting.adoc | 18 ++++++++++++++++++
4 files changed, 27 insertions(+), 4 deletions(-)
diff --git a/src/site/content/jakarta-ee.adoc b/src/site/content/jakarta-ee.adoc
index c35e7f953..dce8c9aed 100644
--- a/src/site/content/jakarta-ee.adoc
+++ b/src/site/content/jakarta-ee.adoc
@@ -183,6 +183,11 @@ RememberMe functionality is disabled by default. You can
enable it easily by add
----
authc.useRemembered = true
----
+RememberMe uses secure cookies by default. If you are running in non-HTTPS
environment, you can disable secure cookies in Jakarta Faces' development mode
only by adding the following to `shiro.ini` (this is the recommended
configuration, but make sure production is running in Faces production mode):
+[source,properties]
+----
+securityManager.rememberMeManager.secureInDevMode = false
+----
[#rate_limiting]
==== Rate limiting: Automatic delay when login failed
diff --git a/src/site/content/spring-boot.adoc
b/src/site/content/spring-boot.adoc
index f01913128..b94347890 100644
--- a/src/site/content/spring-boot.adoc
+++ b/src/site/content/spring-boot.adoc
@@ -151,9 +151,9 @@ protected CacheManager cacheManager() {
|shiro.rememberMeManager.cookie.domain |null |RememberMe cookie domain
-|shiro.rememberMeManager.cookie.path |null |RememberMe cookie path
+|shiro.rememberMeManager.cookie.path |ROOT_PATH |RememberMe cookie path
-|shiro.rememberMeManager.cookie.secure |`false` |RememberMe cookie secure flag
+|shiro.rememberMeManager.cookie.secure |`true` |RememberMe cookie secure flag
|shiro.loginUrl |`/login.jsp` |Login URL used when unauthenticated users are
redirected to login page
diff --git a/src/site/content/spring-framework.adoc
b/src/site/content/spring-framework.adoc
index cc31253f4..53b04a061 100644
--- a/src/site/content/spring-framework.adoc
+++ b/src/site/content/spring-framework.adoc
@@ -254,9 +254,9 @@ age
|shiro.rememberMeManager.cookie.domain |null |RememberMe cookie domain
-|shiro.rememberMeManager.cookie.path |null |RememberMe cookie path
+|shiro.rememberMeManager.cookie.path |ROOT_PATH |RememberMe cookie path
-|shiro.rememberMeManager.cookie.secure |`false` |RememberMe cookie
+|shiro.rememberMeManager.cookie.secure |`true` |RememberMe cookie
secure flag
|shiro.loginUrl |`/login.jsp` |Login URL used when unauthenticated users
diff --git a/src/site/content/troubleshooting.adoc
b/src/site/content/troubleshooting.adoc
index cd78bd9cd..e9fd5a053 100644
--- a/src/site/content/troubleshooting.adoc
+++ b/src/site/content/troubleshooting.adoc
@@ -287,6 +287,24 @@ subject.isAuthenticated();
subject.isRemembered();
----
+4. **Browser cookie issues**: Ensure the browser accepts cookies and that
there are no domain/path mismatches.
+By default, Shiro's Remember Me cookie is HTTP-only and secure. If you're
testing in a non-HTTPS environment, you may need to adjust the secure flag for
testing purposes.
+You can use system property to control this behavior. Set
`org.apache.shiro.rememberMe.secure.disabled` to `true` to disable the secure
flag on the Remember Me cookie for testing.
+You can also configure this in your `shiro.ini`:
++
+[source,ini]
+----
+[main]
+securityManager.rememberMeManager.cookie.secure = false
+----
+For Jakarta EE applications, the secure flag is enabled by default. You can
disable it for testing purposes in Jakarta Faces' Development mode only by
setting the following in your shiro.ini:
++
+[source,ini]
+----
+[main]
+securityManager.rememberMeManager.secureInDevMode = false
+----
+
=== How do I generate a cipher key for Remember Me?
Generate a secure key using Shiro's `AesCipherService`:
